When you connect large models into sensitive scenarios like finance, healthcare, or government, you'll eventually have to answer the most expensive question: for "don't let the cloud see my data," how many times more compute are you willing to pay?
You're about to connect a large model into finance, healthcare, government, or legal — businesses where "data leakage = incident" — yet no one can give you a straight answer to the most basic question: Is it safe to send data to cloud inference? And for that safety, how many times more compute do I need to pay? If you're stuck here, this piece is for you. It lays out TEE, MPC, homomorphic encryption, and split inference as answers to the same "trust pricing" problem: who you're willing to trust (the chip vendor, that multiple parties won't collude, or only mathematics) directly determines whether you pay 1.05×, hundreds of times, or thousands of times more compute.
It's written for three kinds of people, corresponding to three moments when you'll actually need it:
· Technical decision-makers (CTO / architect / platform lead) — choosing between TEE, MPC, homomorphic encryption, and split inference, getting dizzy from every vendor's "≤3× overhead," "zero-trust," and "data never leaves the domain" pitches. This piece gives you a decision tree you can follow directly, and the real overhead of all four routes: 1.05× / 10–100× / thousands× / near-zero.
· Security & compliance leads (CISO / data compliance / Xinchuang) — needing to explain to the board, regulators, or clients "what level of protection our AI inference has, and at what cost"; especially when Xinchuang requirements hit the hard wall of "no domestic GPU has commercial confidential computing yet."
· Privacy-computing researchers, founders, and investors — judging whether a "privacy-preserving" scheme offers cryptographic guarantees, or just the empirical comfort of "send features, not the original image" that can be shattered by inversion attacks.
The evolution and endgame of four technical routes for LLM confidential inference: TEE, MPC, homomorphic encryption, and split inference are essentially four answers to the same "trust pricing" problem. This long-form article dissects their evolution, measured overhead, industry deployment, and the structural contradictions unique to the China market.
Before reading any technical details, narrow down the selection problem first. The compute path for enterprise LLM adoption essentially requires answering four questions in sequence: is the data sensitive → do you have GPUs → are mitigation measures sufficient → are there Xinchuang requirements. Each endpoint corresponds to a technical route that the main text will dissect one by one.
Trust the chip vendor (TEE) and pay less than 10% compute premium; trust that multiple parties won't collude (MPC) and pay 10–100×; trust only mathematics (FHE) and pay 3–5 orders of magnitude; architectural weak guarantees (split inference) cost near zero, but have the weakest formal guarantees.
NVIDIA H100/Blackwell has pushed overhead to single-digit percentages, Apple has deployed it in production (some inference runs on Google Cloud), and Anthropic has published a research proposal. MPC/FHE will only land in the near term in narrow scenarios with strong compliance and tolerance for high latency, such as finance and healthcare.
Domestic CPU-side confidential computing (Hygon CSV, Kunpeng iTrustee) is commercially deployed at scale, but GPU confidential computing on domestic AI accelerators is nearly blank — leaving a window for "MPC on domestic GPUs" and "fallback to self-build."
Federated learning, differential privacy, and zkML — these three are often lumped into the "privacy computing" basket, but their goals are orthogonal to confidential inference: federated learning solves collaborative training without data leaving the domain, differential privacy addresses privacy leakage at the output and statistical level, and zkML addresses the verifiability of inference results, not input confidentiality.
Confidential inference asks only one thing: When a user sends a prompt to a cloud-based large model, or when the model provider hosts weights on third-party compute, how do you ensure that inputs, outputs (and sometimes weights) are not visible to the compute provider during computation? This is the confidentiality problem for "data-in-use" — the last mile that transport encryption (TLS) and storage encryption cannot cover.
The industrial weight of this problem is being continuously elevated by policy: the National Data Bureau's "Trusted Data Space Development Action Plan (2024–2028)" defines trusted data spaces as "data circulation and utilization infrastructure that connects multiple parties and enables data resource sharing," and explicitly names high-performance confidential computing as one of the core technologies for solving data circulation challenges. In other words, whether confidential inference can scale determines not just the security posture of cloud AI, but the technical foundation of the larger data-factor market proposition. And that depends precisely on whether the four technical routes can simultaneously compress "trust cost" and "compute cost" into an interval the industry can accept.
The four routes aren't competing for the same position — they each occupy a corner of the "trust assumption × performance overhead" plane. The ladder below (horizontal axis on a log scale of relative plaintext overhead) is the key to understanding the entire landscape.
The first-generation protagonist was Intel SGX — carving out an encrypted "enclave" in the CPU. But its two fatal flaws nearly defined the early困境 of the entire track: first, enclave memory was only ~128MB, far from enough to hold large model weights; second, the side-channel attack history was alarming — in 2018, Foreshadow directly broke SGX remote attestation; in 2020, CacheOut and SGAxe further proved that even with all side-channel defenses enabled, attackers could still extract attestation keys and forge legitimate Intel machine signatures (CVE-2020-0549). Intel later effectively deprecated SGX on new-generation client CPUs.
The second generation was VM-level confidential computing: Intel TDX and AMD SEV-SNP expanded the protection boundary from "a piece of code" to "an entire virtual machine." This step was crucial for AI — no need to modify model code; just stuff the entire inference stack into a confidential VM.
The real turning point came in 2023, when NVIDIA first extended TEE to the GPU on Hopper (H100). In CC mode, every write to HBM is encrypted with AES-256-GCM inside the GPU security engine; the key is generated inside the GPU and never leaves the chip; data between CPU and GPU travels through an encrypted bounce buffer.
Apple Private Cloud Compute (PCC) is the most complete architectural exemplar to date: custom Apple silicon servers as trust root, trimmed OS, Swift-written inference control layer for memory safety, request data deleted after processing, and verifiable software proofs provided to user devices (Apple Security official architecture post). In 2025, Apple further extended PCC beyond its own data centers — some Apple Intelligence inference runs on Google Cloud's NVIDIA Blackwell GPUs, using a three-layer hardware trust stack of "NVIDIA Confidential Computing + Intel TDX + Google Titan security chip," claimed as the industry's first globally scalable end-to-end confidential inference pipeline.
Anthropic published "Confidential Inference via Trusted Virtual Machines" with Pattern Labs (now Irregular) in June 2025, but this is a research sketch, not a description of a deployed system — the paper itself states it is "just a research sketch meant to start a discussion," and that it's too early to predict what specific design it will evolve into. The idea: most of the inference server stays on the untrusted side; only a small trusted "model loader and invoker" in an isolated VM handles decrypted data; a key server releases keys only after hardware attestation passes; model weights are stored encrypted and decrypted only inside the loader. Its motivation is primarily preventing model weight theft, and it claims this design is intended to resist a malicious hypervisor and some forms of physical attack. The boundaries are stated clearly: accelerators are not yet inside the trust boundary (the required accelerator memory protection features are not mature); data center physical security and hypervisor-layer security still depend on the compute provider; API server security is out of scope. In other words, it neither claims to "assume the service provider is adversarial" nor states it has been deployed; the publicly available material that explicitly designs for "even operators cannot touch the data" is Apple PCC above.
Apple proved GPU TEE can scale in production; per its design specification, devices only send data to nodes whose measurements are written into a transparency log, and it plans to open every production version to security researchers. Anthropic's proposal is still a research sketch — external clients have nothing they can run themselves. For enterprise clients who want to verify things themselves, neither is a ready-made entry point. AI gateway startup TrustedRouter (parent company Lore Hex, codebase formerly Quill) provides the opposite example: it's an OpenAI-compatible multi-model routing API whose core selling point isn't the routing itself, but making "prompts and outputs are never persisted to disk" something externally verifiable item by item, rather than relying on promises alone — the complete method is published on its trust.trustedrouter.com trust boundary page.
The gateway is deployed across GCP Confidential Space, AWS Nitro Enclaves, and Azure SEV-SNP, corresponding to three measurement methods: on GCP, comparing the image digest from the proof JWT issued by confidentialcomputing.googleapis.com with audience quill-cloud; on AWS, measuring the enclave image into PCR0 (SHA-384), where the official script verify-pcr0.sh lets clients rebuild the image from source and compare; on Azure, measuring the SHA-256 (hostdata) from the decoded CCE policy, reflected in the Microsoft Azure Attestation (MAA) token. The common prerequisite across all three chains is api.trustedrouter.com must use DNS-only or TCP passthrough — it cannot be TLS-terminated by any CDN — once terminated, the certificate private key leaves the measured confidential environment, and the trust chain breaks on the spot.
Release artifacts (image digests, PCR0, hostdata comparison table) are signed with cosign keyless and recorded into Sigstore's Rekor transparency log; signatures are bound to the specific GitHub Actions workflow identity that produced the file, not a broad repository regex — verifiers can independently verify offline using a command like cosign verify-blob --certificate-identity https://github.com/Lore-Hex/quill-cloud-proxy/.github/workflows/publish-trust-aws.yml@refs/heads/main. TrustedRouter also clearly documents what this mechanism does not cover: Confidential Space allows overriding an environment variable allowlist under the same image digest — the image digest locks down code, not every parameter at code startup; a signature only proves "who produced this record," not "whether this is the latest record" — to exclude replayed old measurements, you must check Rekor's append-only log, not just trust the website page itself.
This practice of proactively disclosing boundaries perfectly illustrates this article's core judgment on TEE: remote attestation solves trust transfer, not trust elimination. TrustedRouter's increment isn't inventing new confidential computing primitives, but making every link of this transfer — who signed, what they signed, what step it covers — transparent for clients to verify item by item.
When the gateway forwards requests to downstream providers, it applies "attest first, encrypt second" a second time: when routing to providers like Chutes that offer TEE inference, the enclave first separately verifies fresh GPU attestations from NVIDIA (nras.attestation.nvidia.com) and Intel TDX evidence from Intel (api.trustedservices.intel.com), compares them against preset workload measurements, and only after confirmation encrypts the request with ML-KEM-768 (post-quantum key encapsulation) plus ChaCha20-Poly1305; if attestation fails at any link, the gateway only retries with a different verified instance — it never silently falls back to plaintext transmission — this is the concrete implementation of "fail-closed" on a multi-hop chain. It also offers an optional capability orthogonal to confidentiality: Signed Inference Receipts — the gateway uses an Ed25519 key generated at enclave startup and committed into the hardware attestation to sign a JWS over "the exact bytes of this request and response + the actual model and provider routed to," which can be verified offline without reconnecting to TrustedRouter. TrustedRouter draws this boundary equally clearly: receipts prove integrity and provenance, not confidentiality — a middleman who forwarded the request and read the plaintext can equally hold a valid receipt, and the receipt contains no requester identity. This distinction provides a sufficiently concrete product-level counterexample for two things — "verifiability" and "confidentiality" — that are often conflated.
CPU-side is commercially deployed at scale. Hygon CSV is currently the only domestically produced CPU confidential computing technology with commercial-scale deployment: memory encryption uses the national SM4 cipher, remote attestation uses SM2 signatures; CSV3 (Hygon C86-4, late 2023) added memory integrity protection, bringing capabilities on par with Intel TDX and AMD SEV-SNP. Alibaba Cloud has launched confidential VM instances based on Hygon CSV. Huawei Kunpeng iTrustee has obtained CC EAL4+ certification, with TEE secure memory configurable up to 128GB.
GPU-side is nearly blank — this is Xinchuang's biggest hardware bottleneck. As of 2025, no domestic AI accelerator (Ascend, Moore Threads, Biren, Cambricon, Tiansu Zhixin) has a commercial, productized GPU confidential computing mode like H100. The closest is the academic prototype ASCEND-CC from Huawei's Zurich Research Center and ETH Zurich (arXiv:2407.11888) — implementing NPU confidential computing on Ascend 910A by modifying firmware, with inference overhead of only 0.028%–0.91%, but it's a single-tenant research prototype, not a commercial feature.
The trust root problem is this route's original sin. TEE's entire security is staked on two things: the chip vendor has no backdoor, and the attestation system is trustworthy (for an American vendor like NVIDIA, this is itself a trust issue under Xinchuang); and side-channel defenses are adequate (SGX's history proves this is far from assured). In one sentence: TEE is "trust transfer," not "trust elimination" — it narrows trust from "the entire cloud vendor" down to "the chip vendor + a piece of verifiable code."
"TEE narrows trust from the entire cloud vendor to the chip vendor plus a piece of verifiable code. This is a huge advance, but it is trust transfer, not trust elimination."— One of this article's core arguments
MPC splits data into secret shares, distributes them to multiple parties for collaborative computation, and no single party can see the original data. This is a weaker assumption than "trust the chip vendor" but stronger than "trust only mathematics."
Early work included general frameworks like ABY, SPDZ, and CrypTFlow. From 2022 onward, secure inference protocols targeting Transformers emerged densely: Iron, Cheetah, CipherGPT, until 2023's PUMA became a milestone — the first open-source MPC scheme that could securely infer pre-trained Transformers without modifying the model, first achieving LLaMA-7B-level MPC inference: ~5 minutes to generate 1 token. Then came the performance race: BumbleBee (NDSS 2025) cut matrix multiplication communication by 80–90%; Microsoft's SIGMA used function secret sharing + GPU acceleration to improve latency by another 11–19×, first achieving secure inference for GPT-class generative models.
Nonlinear operators are the main battlefield. GELU, Softmax, LayerNorm — these non-polynomial functions are extremely expensive on ciphertext. The entire optimization history of MPC-Transformer is essentially the history of "how to approximate nonlinear operators more cheaply."
Notably, both milestone protocols — PUMA and BumbleBee — came from domestic teams and were made available externally through the open-source SecretFlow tech stack — China's engineering contributions sit in the global first tier on the MPC-Transformer sub-track. On the industry side, vendors like Huakong Qingjiao, Yifang Jianshu, and Guangzhishu are advancing LLM confidential compute productization, generally emphasizing crypto-evaluation / national-cipher compliance advantages; and "pure cryptographic schemes are too costly and need to work with trusted hardware" is already a widespread engineering consensus — MPC + TEE hybrid is widely seen as the realistic path to scale.
The fundamental bottleneck is communication, not computation. GB-level or even hundreds-of-GB data exchange is a decisive bottleneck under WAN. This means MPC in the near term is only suitable for narrow scenarios with "good multi-party bandwidth, tolerable minute-level latency, and strong compliance." GPU-accelerated MPC (SIGMA being representative) is currently the most promising direction for changing the overhead curve.
FHE allows arbitrary computation directly on ciphertext: the client encrypts, the server computes, the client decrypts — the server never sees plaintext. The trust assumption is cleanest, the overhead most terrifying — DARPA's phrasing: a computation that takes 1 millisecond on a laptop would take weeks with today's FHE.
CKKS, BFV/BGV, and TFHE are the three mainstream schemes. Non-interactive HE inference for Transformers is a research hotspot in 2024–2026: NEXUS (NDSS 2025) is among the first to implement non-interactive Transformer inference using RNS-CKKS, but BERT-base (128 tokens) takes ~1103 seconds — and research indicates its nonlinear approximation has a maximum relative error as high as 297%. Even with specialized approximation and GPU implementations, FHE overhead for full LLM inference remains in the thousands-to-hundreds-of-thousands range.
DARPA's DPRIVE program funded four teams — Intel, Duality, SRI, and Galois — to build FHE ASIC accelerators, aiming to pull overhead within one order of magnitude of plaintext; Intel's ASIC with Microsoft claims ~million× acceleration. Cornami takes reconfigurable many-core, Optalysys uses optical computing, Niobium has taped out, and Fabric Cryptography's chip is expected to tape out within a year. Whether the 1000–5000× improvement claimed by these accelerators is "enough" remains an open question.
Deployment reality: What FHE can land today is "small and beautiful" retrieval, not LLM inference. Apple uses HE for encrypted database queries (caller ID lookup without exposing the queried number), not for running neural networks with HE. Zama became FHE's first unicorn at a $1B+ valuation, but its FHEVM on-chain throughput is still only dozens of transactions per second. This itself shows: FHE's industrialization breakthrough is in lightweight, high-value, latency-tolerant scenarios. Hybrid schemes (HE for linear operators only, nonlinear handed to MPC or TEE) are a more pragmatic engineering path — BOLT and BumbleBee are essentially HE/MPC hybrids.
Pulling homomorphic encryption from "theoretical upper bound" toward engineering usability, a noteworthy hybrid route has emerged domestically — Jinghua Confidential Compute's confidential training/inference platform is representative. Its approach can be summarized in three sentences: First, linear and nonlinear operators are computed separately, structurally splitting apart the most cryptographically expensive parts; Second, CPU-TEE and GPU heterogeneous scheduling — key management and the sensitive control plane land in the CPU TEE (millisecond-level random key generation and destruction), while large-scale matrix operations go to the GPU; Third, encryption granularity is at the request level, with each inference request randomly encrypted and computed token-by-token in ciphertext, so inputs and results are visible only to the requestor.
Unlike most schemes that only do confidential inference, Jinghua covers confidential training (ciphertext model training, ciphertext retrieval, confidential vector DB), and claims that while adapting to mainstream domestic GPUs, both confidential training and inference time overhead relative to plaintext are controlled within 3× — if independently verified, this would be significantly below the pure MPC (10–100×) and pure FHE (10³–10⁵×) ranges, at the cost of introducing hardware trust in CPU-TEE (deployment requires CPU TEE support). Deployment form factors include confidential compute appliances (inference: dual-socket CPU + 4 GPUs; training: dual-to-quad-socket CPU + 8 GPUs) and software deployment; publicly disclosed projects include the Lecheng Healthcare Confidential Training Trusted Space and the Yangtze River Delta Healthcare Pilot Zone platform, with CAICT confidential standards and Level 4 classified protection evaluation progressing in 2026.
To be objective: "≤3×" is a vendor claim lacking published third-party benchmarks; and this route's trust assumption is no longer "trust only math," but a hybrid of "math + CPU chip vendor" — this is the price it pays for performance, and why it's covered in this chapter rather than given its own.
The industry significance of this hybrid route is: it demonstrates that HE's realistic path in LLM scenarios isn't "wait for ASIC to save pure FHE," but use cryptographic guarantees where they matter most, and hand performance-sensitive parts back to hardware trust — essentially creating a new gear in the middle of the trust-pricing ladder.
Run an encoder locally, send only the compressed intermediate features to the cloud large model — raw input never leaves the device. Overhead is nearly zero — it's just normal neural network forward computation.
Real example: GLM-4.5V (released and open-sourced by Zhipu in August 2025, 106B total / 12B active params) consists of a visual encoder, MLP adapter, and language decoder — the visual encoder can be placed on the edge side, uploading only compressed visual features, making it a natural fit for split inference in multimodal scenarios. Apple Intelligence's "edge-first, go to cloud only when necessary via PCC" tiered architecture is essentially also a split-inference design.
The companion open-source implementation of this project, VIT Secure Inference (GitHub · MIT), turns this route into an installable product: on a local Mac, a 300M-parameter ViT visual encoder (Metal GPU accelerated) extracts image features, which are Gzip-compressed and only ~1MB of feature vectors are uploaded to the cloud GLM-4.5V for visual understanding and text generation — raw image pixel data never leaves the device, supporting OCR, document/financial report analysis, multi-image comparison, and medical imaging tasks.
Honest boundary note: ViT encoding is a one-way, heavily information-compressing process that significantly raises the reconstruction barrier, but per the feature inversion research below, this is still an empirical guarantee, not a cryptographic one — which is why it's classified under this route, and why we recommend adding noise/obfuscation for high-sensitivity scenarios.
Fatal weakness: feature inversion attacks. "Send features, not the original image" sounds safe, but extensive research proves intermediate representations can be partially or even high-fidelity reconstructed: FIA-Flow (2025) trains a black-box inversion model using less than 0.32% of ImageNet-1K samples, achieving high-fidelity reconstruction of original images; CapRecover (ACM MM 2025) can directly reconstruct text descriptions of images from visual features; for LLMs, Vec2Text-style embedding inversion work also exists. Defenses (adversarial training, feature sparsification, noise addition) all involve accuracy-privacy tradeoffs, and none provides cryptographic-level formal guarantees.
Positioning conclusion: Split inference is a "cost-driven" rather than "guarantee-driven" approach. It suits consumer-grade scenarios with moderate privacy sensitivity and extreme sensitivity to latency and cost; for any scenario involving finance, healthcare, or government that requires provable confidentiality, it can only serve as an auxiliary layer, not the primary defense line.
| Route | Trust Root | Relative Plaintext Overhead | Formal Guarantee | Representative Scheme / Product | Xinchuang Fit | Typical Scenario | Maturity |
|---|---|---|---|---|---|---|---|
| TEE / GPU CC | Chip vendor + verifiable code | <10% H100 average <7%, Blackwell approaching zero | Medium Depends on hardware + remote attestation | NVIDIA H100/Blackwell CC · Apple PCC · Anthropic Confidential Inference (research sketch) · TrustedRouter (three-cloud attestation gateway) | Weak Trust root is NVIDIA; domestic GPU TEE is blank | General cloud confidential inference, cross-jurisdiction deployment | Commercially deployed at scale |
| MPC | Multi-party non-collusion assumption | 10–100× Communication in GB range, bottleneck is bandwidth | High Cryptographic | PUMA · BumbleBee · SIGMA · SecretFlow open-source stack | Strong Pure software runs on domestic GPUs, easy crypto-evaluation pass | Finance / healthcare cross-institution data fusion | Narrow-scenario deployment |
| HE+TEE Hybrid Operator Separation |
Math + CPU chip vendor (hybrid) | Claims ≤3× Vendor figure, pending independent verification | Fairly High Primarily cryptographic + TEE control plane | Jinghua Confidential Compute confidential training / inference platform (appliance + software deployment) | Strong Adapts to mainstream domestic GPUs, national-cipher certification in progress | Trusted data spaces, confidential training, cross-border data circulation | Early commercial stage |
| FHE | Trust only mathematics | 10³–10⁵× Hardware acceleration is the only hope | Highest Cryptographic | NEXUS · Zama TFHE · Apple swift-HE (PIR) | Medium Algorithms can be national-cipher adapted, performance not yet usable | PIR-class lightweight encrypted retrieval | Lightweight retrieval only |
| Split Inference | "Features hard to invert" (empirical) | ≈ 0 | Weakest Vulnerable to feature inversion attacks | GLM-4.5V edge-cloud synergy · VIT Secure Inference · Apple edge-cloud tiering | No specific hardware dependency | Consumer-grade / low-sensitivity default cost-reduction layer | Consumer-grade auxiliary |
The China market is not a simple rescaling of the global landscape — it has three unique structural constraints that together give rise to China's distinctive "fallback to self-build" logic.
The de facto standard for global cloud confidential inference is converging on NVIDIA GPU CC, but its trust root (remote attestation, chip keys) is entirely in NVIDIA's hands. You use confidential computing to avoid trusting the compute provider, yet you must unconditionally trust an American chip vendor's attestation system.
On domestic hardware, confidential inference in the near term can only rely on software cryptographic schemes (MPC) running on domestic GPUs/CPUs, or on Hygon CSV / Kunpeng TEE for VM-level protection — unable to replicate NVIDIA's low-overhead GPU confidential inference path. This in turn reinforces the "MPC + TEE hybrid with national ciphers" technology choice.
GB/T 43206-2023 crypto-evaluation standard took effect in April 2024,叠加 the "Data Factor ×" three-year action plan's policy drive — schemes using national ciphers (SM2/SM3/SM4) gain natural compliance advantages in strongly regulated scenarios like government and finance, a local moat that international vendors cannot replicate.
The combined result of these three forces: for institutions with the highest confidentiality requirements (major banks, top-tier hospitals, government clouds), rather than wrestling with the confidential inference trust chain on public clouds, it's better to directly deploy domestic hardware + domestic confidential schemes privately — the cost is higher ops overhead and limited external service efficiency, but under current technical constraints this is a structurally rational choice. The policy side is trying to pull this "fallback" demand back into trusted cloud-based confidential circulation: the National Data Bureau's "Trusted Data Space Development Action Plan (2024–2028)" explicitly names high-performance confidential computing; on the deployment side, per vendor disclosures, the Lecheng Healthcare Confidential Training Trusted Space (the country's first trusted space supporting AI confidential training on medical datasets) and the Yangtze River Delta Healthcare Pilot Zone platform both use "compute-without-decrypting" as the technical foundation for solving cross-domain trust — with a build-out target of covering 30 leading pharma companies, 2,800 key hospitals, and 1,000+ data entities in the Yangtze River Delta by 2027.
On the demand side, real buyers are highly concentrated in four categories: finance (risk control, cross-institution data fusion), healthcare (medical records, genetic data cross-center collaboration), government (data factor circulation), and cross-border (data export compliance). On the supply side, market forecasts diverge enormously: Grand View Research gives ~$153.8B by 2030 (CAGR ~64%), Precedence Research gives ~$1.28T by 2034, while conservative forecasts from TechSci et al. put 2030 at only $10–23B. A forecast divergence of tens of times is itself a signal: this market is still early, metrics are chaotic, and consensus hasn't formed. The rational reading is to focus on the growth direction (high-speed) rather than absolute numbers.
"Under Xinchuang constraints, confidential inference currently has no cheap cloud solution. Falling back to self-build is structurally forced."— Core judgment of the China Market chapter
Selection doesn't need a new framework — the decision tree at the opening is the action guide. Below, each of the four decision nodes is expanded: every branch gives the endpoint, action items, and the threshold that triggers fallback.